Unfollowed: How a (Possible) Social Network Spy Came Undone (I miss her!)

Unfollowed: How a (Possible) Social Network Spy Came Undone
by Spencer Ackerman, wired.com
January 2

It started out with a leggy, bikini-clad avatar. She said she was a missile expert — the “1st Lady of Missiles,” in fact — but sometimes suggested she worked with the CIA. With multiple Twitter and Facebook accounts, she earned a following of social media-crazed security wonks. Then came the accusations of using sex appeal for espionage.

Now everyone involved in this weird network is adjusting their story in one way or another, demonstrating that even people in the national security world have trouble remembering one of the basic rules of the internet: Not everyone is who they say they are.

“I think anyone puts pictures out online to lure someone in,” the woman at the center of the controversy insists. “But it’s not to lure men in to give me any information at all… I liked them. They’re pretty. Apparently everyone else thought so too.”

This is a strange, Twitter-borne tale of flirting, cutouts, and lack of online caution in the intelligence and defense worlds. Professionals who should’ve known better casually disclosed their personal details (a big no-no in spook circles) and lobbed allegations they later couldn’t or wouldn’t support (a big no-no in all circles). It led to a Pentagon investigation. And it starts with a Twitter account that no longer exists called @PrimorisEra.

The subject of much confusion and even more speculation, @PrimorisEra purports to be a woman in her late 20s named Shawn Elizabeth Gorman. Many have corresponded with her through Google Chat, IM, Facebook, and Twitter. Very few of them have met her in person. She claims to hold a security clearance and work for a Defense Department contractor that she won’t identify. According to Johns Hopkins University, a woman with that name is pursuing a masters’ degree in government and business.

That is not how she has presented herself on the Internet.

Sometimes Shawn Elizabeth Gorman is Shawn Elizabeth Gorman. Sometimes she’s Shawna Gorman. Sometimes she’s Shawna Felchner. Sometimes she’s @PrimorisEra. Sometimes she’s @shawna1814. Sometimes she’s @ladycaesar. There may be more. Among the details she offered about herself: she was indeed part of the Johns Hopkins network, but was also a missile specialist living in Brussels.

True confession time: Earlier this month, I accepted a Facebook friend request from Shawna Gorman. Why? I saw several friends of mine from the national security and journalism worlds were already friends with her. Even NATO’s Supreme Allied Commander, Adm. James Stavridis, was a mutual Facebook friend. I clicked Accept after lazily scanning those credentials, because that’s what you do in this day and age.

Over the last several months, some in the world of national security learned about @PrimorisEra through her prolific tweets about various missile programs and efforts. Like everyone on Twitter, she liked to have fun. She winked at friend @SexyRavenUAV, one of several joke accounts ostensibly written by killer drones: “@SexyRavenUAV women are dangerous creatures… you & I know this prolly better than most men.”

‘She kept asking where I was stationed, where I was deploying… A lot that we shouldn’t be talking about.’
She also liked to tweet about her familiarity with the dark world of spies and special operators. A since-deleted tweet from April 4, apparently about the Libya war, read, “‘No troops on the ground’…. OGA don’t wear uniforms, its the anonymous that get the proverbial middle finger.” OGA, or Other Government Agency, is a euphemism for the CIA.

Rarely, if ever, did @PrimorisEra’s avatar show her face. But sometimes it showed a woman’s legs, or a bare shoulder with a sheer sweater. Or a woman in a bikini. That had the effect of attracting attention from dudes in the military and intel worlds, shielded by the pseudonymity of Twitter.

Identifying himself as having “expertise in asymmetrical engagement and counter-terrorism,” @Shad0wSpear tweeted on March 15 that if he had ever got assigned a World War II era Boeing “Flying Fortress,” he’d “plaster your beautiful image all over it.” Telling people to follow her, @BunduBoots called her “far more informative & way more attractive than a Jane’s annual.”

Which is par for the course online. People try to look sexy. They flirt. Others flirt with them. Harmlessly.

To some people she direct messaged, it crossed a line. One male tweeter on active duty she contacted through DM and chat thought most of her banter was harmless. But some of it struck him as “creepy,” he tells Danger Room: “Where I was stationed, where I was deploying, pressing me for details… A lot that we shouldn’t be talking about.” He thought she should know better not to ask for sensitive specifics like that, especially on unclassified forums, since @PrimorisEra “presented herself as a DoD [Department of Defense] employee.”

But @PrimorisEra didn’t always present herself as a Pentagon worker. According to a chat log acquired by Danger Room, she told someone in an unsecured GoogleChat, “you do know I do wrk w/ WINPAC.” That’s the acronym for the CIA’s arm for weapons and arms control intelligence.

She offered to help her interlocutor get a job with the CIA, prompting him to offer to send her his resume. He began to talk about an individual “known around Langley” by first name only. Asking for her last name, @PrimorisEra wanted to know what his connection to her was.

Several women national security experts on Twitter rolled their eyes at @PrimorisEra, thinking she was acting out for male attention and not as much of an expert as she conveyed. During a happy hour at the D.C. bar Science Club last week, some of them got to talking about how they thought her account was either fake or a big inflation of her national security credentials.

Finally, one of them, a Defense Department contractor tweeting as @FrostinaDC — who asked Danger Room to keep her real name out of this piece — called her out on Friday.

“A bikini perpetuates your fake persona & makes the boys want to screw you,” @FrostinaDC tweeted, the first of a fusillade of tweets that quickly drew in the national-security twittersphere, eager to watch a trainwreck in progress. Questioning “the validity of that account,” @FrostinaDC followed up. She tweeted URLs for pictures that @PrimorisEra used for her avatar, as @PrimorisEra had said her “management” helped select profile pictures of herself. In a since-deleted tweet, @PrimorisEra replied that @FrostinaDC should be careful, because @PrimorisEra “knew all the right people.”

That set @FrostinaDC off for the coup de grace — something that she assembled after what she says is ferocious open source online sleuthing and conversations with those who talked to @PrimorisEra.

“Just to be clear,” she tweeted on Saturday, “I have intel that @PrimorisEra is a Honey Pot & if you’re in my field you know what that means.”

What it means is someone who uses sex appeal to get someone to divulge their secrets. It implies that @PrimorisEra is the agent of a foreign power. That was an accusation no one had heard before. It’s also about the most serious charge that someone can levy.

Gorman responded by culling the social media accounts that got her so much attention. By Sunday, @PrimorisEra was no longer an active account. Her Facebook profiles either got locked or deleted. Other accounts were shut down. “WIN!!!!!” was @FrostinaDC’s reaction.

On Monday, @FrostinaDC turned in her tranche of documents on @PrimorisEra to the Pentagon, to begin an investigation into whether @PrimorisEra or anyone interacting with her violated security protocols.

Gorman denies any wrongdoing. In a series of Facebook messages to Danger Room, she says, “I have NEVER threatened @FrostinaDC and I have NEVER given out classified or sensitive information nor have I EVER asked for it.” She says that her employer has asked her not to talk to the press, and won’t say who she works for.

But she’s appointed a liaison, the author, journalist and military-affairs commentator John D. Gresham, to speak for her. Gorman Facebooked me a “verification” code — “Tabasco” — and hours later, Gresham called me without solicitation, read it to me, and said that he could speak on her behalf.

We met at a northern Virginia Starbucks on Thursday — after he swore he isn’t Gorman or any of her online personae.

It goes on like this for nearly an hour. Then, Gresham makes a phone call and asks for my cellphone number. I get a call moments later. “This is Shawna,” my caller answers.

She reiterates that @PrimorisEra is no spy. She tells me that she’s “never solicited classified or sensitive information.” Did she tell people that she worked with WINPAC? First she says no. Then she says, “There might have been things, terms used sarcastically, in terms of employment.” She lives in the D.C. area, not Brussels, she says, and used that city as her home because it’s the “big hubs of politics and diplomacy,” her interests.

Does she understand why national security professionals might think she was gathering information on them? “I understand. I completely understand. I’ve never done it,” @PrimorisEra says. “If I ever asked anything like, ‘Oh, where do you work,’ one of those things, it’s friendly. I understand how that can be skewed.”

How did she react to being called a honeypot? “I laughed, in terms of how asinine it was,” @PrimorisEra says. “I put out information. I have no need to gather it, I don’t want to gather it.”

She’s not putting out information now. Gorman’s social media profiles are down, at the behest of her still-unnamed employer. Only @LadyCaesar survives and she’s not tweeting right now. She says she hasn’t been contacted by any government investigators — and that she wants this “nonstory” to go away.

The volley of bashing tweets outpaced the proof of wrongdoing. ‘It looked like a high school lynching.’
Additionally, @FrostinaDC has no regrets about calling Gorman out. From her perspective, she wanted to call attention to @PrimorisEra to warn people in the national security world to be extremely cautious about what they say on social media under the mistaken assumption that it’s either private or anonymous.

But @FrostinaDC says she should have clarified what she meant by using the terms “honey pot” and “honey trap,” saying she has no evidence that @PrimorisEra works for any foreign power. She claims to have provided additional evidence to Pentagon investigators of @PrimorisEra’s questionable online interactions with security professionals, but she wouldn’t provide it to Danger Room.

She meant the term in the sense of someone who uses sex appeal to gain access to sensitive material, @FrostinaDC says, which she absolutely stands behind.

It’s an apt reminder, given that the Pentagon swears it’s not going to take away troops’ access to social media, something that Joshua Foust of the American Security Project blogged that he feared would be the legacy of the contretemps. And it’s an area of common ground with @PrimorisEra’s camp. “Everyone needs to be a little more cautious,” says Gresham.

Among the community of national security tweeters, theories abound about what @PrimorisEra was really up to. None consider her a twitter-born Anna Chapman — one of the Russian sleeper agents planted, and then discovered, in the United States.

Some wonder if her multiple layers of internet personae mean she’s part of an effort by a private firm to see if Pentagon or intelligence employees and contractors are spilling the beans to anyone who pokes them. Far more think she’s a wannabe who puffed up her bona fides on the internet to security professionals to fit in.

Whether they meant to or not, though, they also ganged up on someone. They speculated publicly about her identity and loyalty. They attacked her avatars as evidence of misrepresentation, as if not using your real face on Twitter is suspicious. (My avatar is a photoshopped Black Flag record cover.)

Ironically, for all the concern about the blitheness of dishing on Twitter, the volley of tweets bashing @PrimorisEra outpace the amount of proof of actual wrongdoing. Naval analyst Raymond Pritchett tweeted that it strikes him as a “factless high school lynching.”

If the investigation clears Gorman, the warnings about not talking recklessly on Twitter will be woefully ironic.

It’s unknown how long that inquiry will last. Until it’s complete, it’s hard not to focus on one of @PrimorisEra’s tweets, now lost but for Googlecache. “A woman in my place has two faces;” she tweeted on March 24, “one for the world, and one which she wears in private.”

See Also:

For more great coverage of science, technology, culture, business, and design, visit WIRED.com.